Comments on Black Fist Security: Pointsec for PC: Creating a Boot Disk

Hi, I have a situation here where the laptop that...

2010-10-20T03:11:00.190-07:00

Hi,
I have a situation here where the laptop that had the encryption on it died. The hdd is ok. When i plug it into another system to get the files off it i'm running into trouble. Have loaded off the hdd and put in my log info, pressed ctrl and f10 and then when the logon goes through i see: POINTSEC ... starting Alternative Boot Menu... But it just sits at that screen. Any idea how to move on from here? ANy help would be very much appreciated.

The Boot CD has to have the drivers for the hardwa...

2010-08-23T06:05:28.499-07:00

The Boot CD has to have the drivers for the hardware the disk is in as well as the pointsec driver. If either is missing it will not work becasue the boot cd will not see it.

I'm pretty f****d here. Got Pointsec v7 insta...

2010-08-19T19:28:29.283-07:00

I'm pretty f****d here.

Got Pointsec v7 installed on a stupid Dell Latitute E6500 laptop and I ran into some problems booting WinXP.

HDD is fine I'm sure of that, I just need to modify my boot.ini because of a custom HAL installed caused a BSOD with SP3 just installed. Even Fail-safe doesn't work.

But here's the thing. I reach Pointsec login, do CTRL-F10, I log my Pointsec credentials and after I just get 3 choices of alt device:
1. Floppy
2. Fixed Disk
3. PE custom disk

This Dell is HDD/DVD SATA embedded and nothing seems to be detected (no USB nor CD-ROM) as alternate device. Tried a BIOS update(booting Hiren from CD directly) and played with all the SATA/USB settings to no avail.

Ok then I had the idea to boot the Pointsec HDD onto another PC (HP desktop) so I would get more alternate device.

Bingo, put my 2.5 SATA HDD on my HP desktop, let the HDD reach PointSec, CTRL-F10, log in, and voilà I have CD-ROM, USB, etc device.

Then, I boot Hiren mini-winxp from CD but when I click my C & D partition from the PointSec HDD, I get "THIS DRIVE ISN'T FORMATED, WOULD YOU LIKE TO FORMAT IT NOW?"

Gosh, I almost got it :(

My tought it that Pointsec detect and only allow access to date on the PC is was installed right, even with right credentials on another PC right?

Any idea?

If only I could get a CD-ROM booting after the WindowsXP has started (like at F8 fail-safe menu)

Will try to get the .rec from my HQ server tomorrow, if not I'm f***k right?

I have followed your instructions to a T and nothi...

2010-06-23T09:44:20.083-07:00

I have followed your instructions to a T and nothing is happening after pressing Ctrl + F10 on the Pre-Boot Environment screen. It just goes ahead and loads the OS. We do have WIL enabled on both the console and laptop. It does the same thing even if i try temporarily disabling WIL in the customization secion.

We are using version 6.3.1.1270.

What am I doing wrong?!!!

Guys, know it is a long shot but is anyone able to...

2010-03-09T06:32:32.283-08:00

Guys, know it is a long shot but is anyone able to provide me with a version the Resource Kit (pointsec.zip) for verion 4.3? My Windows XP has corrupted and it wants DLLs after authenticating in PointSec. Incidentally does the CTRL +F10 work with earlier versions of PointSec? I do not get a CD boot option after PointSec authentication with CTRL+F10. Any suggestions? jT

@roman. Any chance I can get a copy of that resour...

2010-03-03T21:37:56.367-08:00

@roman. Any chance I can get a copy of that resource kit?

@ Daniel, you can contact me, i have the working p...

2010-02-23T10:57:02.767-08:00

@ Daniel, you can contact me, i have the working plugin for 6.3.1

greetings

@ Daniel, you can contact me, i have the plugin fo...

2010-02-23T10:54:21.013-08:00

@ Daniel, you can contact me, i have the plugin for 6.3.1.

@anonymous from Jan 11: Does you BART disk work on...

2010-01-11T12:49:45.717-08:00

@anonymous from Jan 11:
Does you BART disk work on a machine that is not encrypted? The only reason I can think of that it wouldn't boot to the disk is if there was something wrong with the disk and the disk is not bootable. In that case it would fall back to booting the hard drive.

Running pointsec 6.3.1 HFA7 and followed the instr...

2010-01-11T11:27:53.857-08:00

Running pointsec 6.3.1 HFA7 and followed the instructions to build a bartpe disk.

I'm just testing and the test system is actually booting fine. Once I hit ctrl-F10 and log into preboot and select boot from PE, the system boots directly to windows.

ie the system does not boot to bart's.

is HFA7 supported?

Talked w/ Checkpoint support and they indicated th...

2010-01-05T11:04:19.982-08:00

Talked w/ Checkpoint support and they indicated the DMU version currently avaiable doesn't work w/ 64-bit Windows 7. New version is tentatively scheduled for the middle of Q1 2010.

Can anyone provide me with a Point Sec Resource Ki...

2009-12-31T16:01:15.374-08:00

Can anyone provide me with a Point Sec Resource Kit 6.3.x. Thank you.

Black Fist, thank you for your work. I have follow...

2009-12-31T15:57:46.117-08:00

Black Fist, thank you for your work. I have followed your instructions on downloading bart pe. I can not find the resource kit. Can you please be more specific. Thank you.

We've used this successfully with Windows XP. ...

2009-12-27T07:52:58.357-08:00

We've used this successfully with Windows XP. We are testing R73 on 64bit Windows 7 and haven't had the same luck. Using the wow64 version of prot_2k.sys the CD boots OK, but we get an error when we try to select the encrypted volume. Anyone have better luck? Thanks in advance.

So the DMU piece built-in to BartPe is beautiful a...

2009-12-21T07:59:49.774-08:00

So the DMU piece built-in to BartPe is beautiful and works great except on Windows 7 64-bit. Attempted use on two differnet hardware platforms with no success. Works on XP fine (R71, R72 and R73), not tested on Vista. Wondering if you ran into this problem or have any insight. Thanks and awesome site.

Would anyone please be able to send me the plugin ...

2009-12-15T10:24:14.983-08:00

Would anyone please be able to send me the plugin

Our install is on a network share and no-one seems to know who put it there and didnt copy the resource kit folder.

phoned pointsec who arnt very helpful the guy said he has never heard of a resource kit or bartPE :|

email address: leewilson74@hotmail.co.uk

great walk through by the way

In regard to decrypting bit for bit image files ta...

2009-12-10T08:39:46.459-08:00

In regard to decrypting bit for bit image files taken from a PointSec encrypted drive, you may wish to look at: http://blogs.sans.org/computer-forensics/2009/09/11/decrypting-a-pointsec-encrypted-drive-using-live-view-vmware-and-helix/.

While complex, convoluted, and way too painful, this process will yield a forensically sound image of an entire decrypted drive with all metadata intact for the drive, not just the unlocked partition(s).

If all you need to do is access/recover the data without regard to Chain of Custody, then mounting the drive r/w using BartPE or slaving or any other method will be fine.

jmb

You must satisfy point-sec security in the boot pr...

2009-08-26T10:12:51.250-07:00

You must satisfy point-sec security in the boot process as detailed on the blog. The prot_2K.sys file only comes into play with pointsec and only with the version of pointsec it was designed for. If it was not loaded properly or was the wrong version, it would not work.

@GiantKiller, Thanks I'll try to add some addi...

2009-08-25T02:36:35.001-07:00

@GiantKiller, Thanks I'll try to add some additional drivers, but what i've observed the BartPE created is working perfectly on a machine that has no pointsec, but when tried to a machine with a pointsec, thats the error...prot_2k.sys, thanks

hi, i already created a boot disk recovery using ...

2009-08-25T01:15:32.745-07:00

hi,

i already created a boot disk recovery using the tools in pointsec but there are 2 partitions C and D but it only shows only the C Drive and then i decrypt the C drive. so how shoul i decrypt the drive? please advise. Thanks

You do not have the proper drivers loaded into the...

2009-08-20T18:15:45.953-07:00

You do not have the proper drivers loaded into the build - these would the critical - IDE or Sata, networking and or video - get those correct drivers blended into the build deck to make the boot CD. THe steps to do this are on the Bart website

Hi I followed all the instruction, created a BARTP...

2009-08-20T06:30:12.346-07:00

Hi I followed all the instruction, created a BARTPE disk with no errors at all have the necessary prot_2k.sys, then boot the disk, after a few minutes BSOD...prot_2k.sys what would be the problem

Assuming you have followed the process correctly i...

2009-06-30T02:20:13.268-07:00

Assuming you have followed the process correctly in making the CD, then you do not have the drivers installed on the CD. Part of creating the Boot CD is integrating the drivers for the hardware into it.

Brian, have you gone through the Pointsec regular ...

2009-06-26T11:12:11.986-07:00

Brian, have you gone through the Pointsec regular login screen? Only after that you should boot from the CD.

I have gone thru the instructions of creating a Ba...

2009-06-24T11:54:22.737-07:00

I have gone thru the instructions of creating a Bart boot cd and login. But after login into Bart its not recognizing the encrypted hard drive. Any suggestions?

Thank you
Brian